04 � Second Quarter Sales up for Oberthur

14 � Smart Cards for Windows

07 � Treviso Launches Fares that go downas you Travel

04 � Orga Scores for Man U in Malaysia

© 2004 Smart Card News Ltd., Brighton, England. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in anyform or by any means, electronic, mechanical, optical, recording or otherwise, without the prior permission of the publishers.

Smart Card News � Smart Card News � Smart Card News � Smart Card News � Smart Card News � Smart CardNews � Smart Card News � Smart Card News � Smart Card News � Smart Card News � Smart Card News �Smart Card News � Smart Card News � Smart Card News � Smart Card News � Smart Card News � Smart CardNews � Smart Card News � Smart Card News � Smart Card News � Smart Card News � Smart Card News �Smart Card News � Smart Card News � Smart Card News � Smart Card News � Smart Card News � Smart CardNews � Smart Card News � Smart Card News � Smart Card News � Smart Card News � Smart Card News �Smart Card News � Smart Card News � Smart Card News � Smart Card News � Smart Card News � Smart C

This Month�s Lead Story

In This Issue

Smart Card NewsSmart Cards, SIM, Biometrics and RFID

www.smartcardgroup.com

October 2004 Volume 13 � Number 10

02 72Kbyte Chip Meets CommonCriteria

Regular Features01 Smart Cards on the Web02 Lead Story - 72Kbyte Chip Meets Common Criteria12 Events Diary14 On the Move

World News In Brief03 Smart Card Consortium03 Growth for UK Access Market03 UK Get First Digital Tachographs04 QUICPay goes Mobile in Trial05 Axalto to Track Medical Waste05 Memory Card goes Contactless06 Biometric System for US DoD

Featured Articles 08 Using Contactless Technology in Secure Identification Systems09 Making Life Difficult11 Off with the Old, on with the New12 When It Comes To Targeting Customers & Keeping Them Loyal, Its

All About Relevance14 The End of Cash as We Know it?16 Continued US Investment in Smart Cards18 For High Security: Contacless Smart Cards are the Answer

11

Sm

art C

ard o

n th

e W

eb

Sm

art CC

ard oo

n tth

e WW

eb

Smart Card News � October 2004

DioneDione has launched its own e-commerce web site this month,which provides a convenient way for its customers to supporttheir payment terminal estates. The site provides a range ofaccessories, consumables and maintenance items that can beordered for next day delivery. From this site you can buy acces-sories such as PIN pad cradles, terminal wet covers and holsters,plus consumables like printer paper rolls and batteries. The web-site itself is very easy to use and the navigational bar, positionedat the top of the page, breaks the rest of the site down into eas-ily accessible areas. The website also provides information aboutDiones latest news and investor information. The site employsa pastel blue colour on a simple white background.

Navigation !!!!!Content !!!!!Appearance !!!!!

www.dionedirect.com

Ingenico

The front page of Ingenico's website is a lot more busy thanthe other two reviewed in this issue. The site shows their latestnews and has framed boxes showing the company�s products,solutions and services. The site employs both text and pictureswhich combined give both a pleasant look to the site while por-traying all relevant information about the company and its prod-ucts. The site offers downloadable datasheets on all Ingenico'sofferings. The site uses both French and English and has a verysimple to use side navigational bar making it easy to get around.The site also has a live link to the company's share price. Thepages of the site also come in printable formats, overall it has alot of informative content and the navigation is quick and sim-ple.

Navigation !!!!!Content !!!!!Appearance !!!!!www.ingenico.com

Thales e-Security

The first thing you notice about the Thales website is that is usesa lot of flash, but does not distract or effect the downloadingof information. The site hosts a range security, banking andfinancial transaction processing equipment, with PDF's abouttheir products. The website also features very useful white paperson cryptography, banking and network security. The front pagecontains only a navigation bar and a news window providing thelatest news about Thales. The website uses very simple side nav-igation allowing you to access any relevant information quickly.The design is kept very simple and the content is mainly textbased. Overall the site is easy to use and the information pro-vided is kept short but relevant.

Navigation !!!!!Content !!!!!Appearance !!!!!www.thales-esecurity.com

22

Lead S

tory

Lead SS

tory

Smart Card News � October 2004

72Kbyte Chip Meets Common Criteria Royal Philips Electronics 72Kbyte EEPROM contactless memory chip has been certified to CommonCriteria EAL5+, which according to Philips is a world first for a triple interface Smart Card controller.Thechip has been designed for contactless e-government applications and to meet the new security require-ments being imposed by such governments as the USA, Australia, Germany and the UK for new pass-ports.

According to Philips the 72Kbyte EEPROM memory, high security chip exceeds the specifications forsmart passports set by the International Civil Aviation Organisation (ICAO) and is currently being usedby Sdu Identification who specialise in the development, production and logistical management of highquality identity and financial documents such as passports, identity documents, driving licenses, memorychip cards and Smart Cards.

The SmartMX 72Kbyte EEPROM triple interface controller is the first to have contact, (ISO/IEC 7816and USB) and contactless interfaces (ISO/IEC 14443 A) certified for use in a wide range of applications.The chips are already in volume production and offers a USB 2.0 LS interface to drive end-user accept-ance enabling easy to use digital signature functions and secure physical network access. The chip can beintegrated into Smart Cards or other form factors such as dongles, which can be directly connected to aPC's USB interface. The P5CT072 chip provides an additional 1Kbyte EEPROM for each implemented8Kbyte as a standard industry practice. This ensures that the specified size of EEPROM is available foruse by applications, unimpeded by the operating system, which normally requires a memory overhead.Therefore the 72Kbyte product assures at least 64Kbyte EEPROM of fully usable application memory.

Philips' SmartMX Smart Card controller family, including the 72Kbyte EEPROM triple interface SmartCard IC, uses a unique handshaking technology, which allows a significant reduction in power consump-tion. Philips has further increased the reliability of their technology, extending data retention time fromthe industry standard of 10 years to 20, and increasing the number of write cycles to 500,000. The Smart-MX family also offers linear memory addressing, a dedicated instruction set and security sensors.

Common Criteria is the methodology used for evaluation of security properties of IT products and sys-tems. The Target of Evaluation (TOE) is against defined criteria (Protection Profile) and certification isthe final approval done by the Certification Body. SCN was unable to get the TOE from Philips but waspointed to www.bsi.de or www.commoncriteriaportal.org.

T-Systems in Germany did the hardware evaluation and the composite evaluation was done in France,Germany and Austria and SCN was told to note that these evaluations are application specific. Philipsalso point out that their solution is also suitable for implementation in bank cards for use in financialtransactions. SCN was unable to find out which if any banks were interested.

SSmmaarrtt CCaarrdd NNeewwss is published monthly by Smart Card News Ltd Columbia House, Columbia Drive, Worthing, BN13 3HD EnglandTelephone : + 44 (0) 1903 691 779 � Fax : + 44 (0) 1903 692 616 � General Enquiries : info@smartcard.co.uk ISSN 0967 196X

Managing Director Patsy Everett ~ patsy.everett@smartcard.co.uk � Production and News Editor Jason Smith ~ jason.smith@smartcard.co.ukTechnical Advisor Dr David B Everett ~ david.everett@smartcard.co.uk � Sales Administrator Maxine Laker ~ maxine.laker@smartcard.co.uk

This Issue�s Guest Contributors: � Randy Vanderhoof � Malcolm Fowler.� Peter Thomlinson � Stephen Neff

Russian Agent : Alex Grizov Recon Company �Sport Hotel� 5th Floor Leninsky Prosp., 90/2 Moscow 117415 Russia

Editorial Consultants Dr Kenneth Ayer � Peter Hawkes � Simon Reed � Robin Townend

Printed by DAP (Sussex) Ltd. Telephone : +44 (0) 1273 430430

Please NoteFrom time to time, Smart Card News may include industry forecasts and forward looking statements made by the companies concerned.

Readers should be advised that Smart Card News Ltd cannot be held responsible for decisions and/or actions taken by readers of our newsletter,based on the information provided including any errors therein, nor are we responsible for the opinions of the individual authors.

Don�t Forget!Our Website containing daily News On-Line, and information about the full range

of SCN services, can be found at the following address: www.smartcardgroup.comCertain images featured in this issue obtained from IMSI�s MasterPhotosTM Collection 1895 Francisco Blvd. East, San Rafael, CA 94901-5506, USA

33

World

New

s in B

rie

fW

orld

NNew

s iin

BBrie

f

Smart Card News � October 2004

Smart Card Consortium

European Commission has named Gemplus Inter-national S.A, as leader of the largest consortium evergathered for a cooperative research project in theSmart Card domain. Called "InspireD", the projectwill develop the new generation of Smart Card tech-nology for Trusted Personal Devices (TPD). TheEC has also granted funding for InspireD for a 3-year period.

The InspireD consortium comprises 16 of the lead-ing industrial and academic stakeholders from theEuropean Smart Card arena. This is so far the onlyEuropean Commission project exclusively dedicat-ed to Smart Cards. It will create a new standard foropen platforms for the entire Smart Card and secu-rity industry. All aspects of Smart Card technologywill be studied, including the silicon component plat-form, the cryptography and security authenticationprotocols for data protection, operating systems, andthe software application layers.

Growth for UK Access Control

In the Access Control Market Report 2004, Researchand Markets has reported that growth in the accesscontrol market was slow in 2002 and 2003. The valueof the market at end-user prices was in the regionof £226 million for 2002, rising to £232 million in2003. Demand for access control has been strong inthe public sector, from schools and universities, localand national government buildings and hospitals.Private Finance Initiative (PFI) contracts havechanged the nature of this market sector.

This study estimates the market to show annualgrowth running at between 3% and 4% from 2004to 2008, in terms of constant 2003 prices. Prospectsfor output of new building work in 2004 and 2005are not favourable in the important commercial andindustrial sectors, although growth is expected forpublic sector non-housing projects.

Massive Smart Card Rollout in SA

South Africa is set to rollout 50-million Smart Cardsin 2004 and 2005. The aim is to have 100-millionSmart Cards in active use in South Africa by 2009.These are the key findings contained in the SmartCard Trends and Deployment in SA 2004 report,released by World Wide Worx and Razor's Edge Busi-ness Intelligence.

Lipman Acquires Dione

Lipman Electronic Engineering Ltd has purchased100% of the share capital of Dione from its share-holders, Tamares Capital Foundation, GE Equityand others. Under the terms of the agreement, Lip-man paid $69 million in cash for all of the outstand-ing shares of Dione.

EMV Definitions for Chip Migration

EMVCo, the EMV standards organisation, hasreleased a set of common data definitions and process-es, which standardises the data interface betweenEMV cards and issuers, resulting in simplified hostprocessing and lower chip migration costs. The EMVCommon Core Definitions (CCD) have been incor-porated into the recently released EMV Version 4.1.CCD defines a common data element content andformat for sending chip information between anEMV card and the issuer via the acquirer. When CCDis incorporated into a card specification, issuers ofmultiple branded cards can achieve benefits of acommon issuer support system.

Chip and PIN Rollout Gathers Pace

The chip and PIN programme has released the lat-est figures on the rollout of chip and PIN cards andtills. By the end of September, 28.4 million card-holders - or two-thirds - had at least one new chipand PIN debit or credit card in their wallets. In total,56.8 million chip and PIN cards have been issued byUK banks and building societies.

At the same time,more than 438,000 tills have switchedover to chip and PIN. More key retailers includingComet, BP and Marks & Spencer have now joinedAsda, Dixons, Wilkinsons, Tesco, Homebase, andPC World to have begun or completed their rolloutprogrammes.

UK Get First Digital Tachographs

The UK is likely to be the first EU nation to imple-ment digital tachograph equipment for commercialvehicles. Orga, which already offers highly secureSmart Card technology for the new digital tacho-graph system, is to supply some two million cardsto the UK's Vehicle and Operator Services Agency(VOSA) in advance of the EU compulsory fitmentdirective for new and not-yet-in-service vehicles,which comes into effect on 5th August, 2005.

44

World

New

s in B

rie

fW

orld

NNew

s iin

BBrie

f

Smart Card News � October 2004

National Card for Bank of Azerbaijan

Thales's Host Security Module (HSM) has been select-ed by TietoEnator for use within the national CardProcessing Centre of Azerbaijan. The Card Pro-cessing Center is the primary nation-wide paymentcard data processing service provider to commercialbanks in the Republic of Azerbaijan.

ActivCard Finishs with Deloitte

Deloitte & Touche LLP (Deloitte), ActivCards inde-pendent registered accounting firm, has resigned,effective September 2, 2004. ActivCard's audit com-mittee has begun the process of identifying and select-ing a new independent registered accounting firm toaudit the Company's financial statements for the fis-cal year ending December 31, 2004.

Smart Cards for Windows

Alacris Inc. and Gemplus International S.A havepartnered to offer a new turnkey Smart Card andcertificate management solution for enterprise Win-dows environments. The technology partnershipintegrates Gemplus's GemSAFE Smart Cards withidNexus for Microsoft, Alacris' flagship product thatprovides integrated management of digital certifi-cate and Smart Card technologies. The combinedproduct offerings provide a Smart Card solution thatnot only brings additional security and convenienceto the Windows networking environment, but alsoreduces the life-cycle management costs of support-ing integrated Smart Card and public key infrastruc-ture (PKI) deployments.

Orga Scores for Man U in Malaysia

Manchester United Football Club is now offering itsloyal fans in Malaysia an exclusive membership pro-gram offering many exceptional benefits. The cere-mony to launch the PB Manchester United Master-Card was held at Head Office, Menara Public Bank(PB) in Malaysia. ORGA Singapore, a subsidiary ofGermany's ORGA Kartensysteme GmbH, is sup-plying the Smart Cards. Public Bank and Barclaycarddeveloped the card program together with the finan-cial unit of Manchester United, MU Finance, to bringfans closer to the club. Card members can look for-ward to exclusive privileges, such as "One United"membership, participation in the MU Points RewardsScheme and entry into a unique points-based con-test.

ORGA is supplying credit cards with a chip from theMultos 4.06 series to Public Bank, which is intro-ducing this first ever card - the PB Manchester Unit-ed MasterCard - in the Asia/pacific region in collab-oration with Barclaycard International.

Free Travel Scheme in IrelandThe British and Irish Governments are consideringa proposal to use Smart Cards to allow free accessto public transport for senior citizens and other eli-gible social welfare groups across the border of thetwo countries. Currently in both Northern and theRepublic of Ireland these groups can travel acrossthe border for free but cannot travel within the juris-dictions. This new plan would allow senior citizenswith a Senior Smart Pass to travel at no cost over theborder and anywhere within Northern Ireland andthe Republic of Ireland. The All-Ireland Free Trav-el Scheme is planned to commence within 2005.

QUICPay goes Mobile in Trial JCB Co., Ltd will start a QUICPay contactless pay-ment system trial project in November. The currenttrial will implement the system in mobile phonescompatible with NTT DoCoMo's mobile wallet serv-ice. Twenty employees of the Kanachu Hire taxicompany, based in Atsugi, in the suburbs of Tokyo,will receive NTT DoCoMo mobile wallet servicehandsets to download the QUICPay application,while about 30 of the company's cabs will be equippedwith contactless readers.

Second Quarter Sales up for Oberthur Oberthur Card Systems sales for the second quarter2004 amounted to 108 million euros showing an 11%increase on a year-on-year basis.The sequential growthduring the first three months of the year reflectsmainly the sales recovery in Mobile Communications(+30.7 %) and Identity & Security (+31.8%) seg-ments.

" Research and Markets

www.researchandmarkets.com

Chip and PINwww.chip-and-pin.info

Manchester United Football Clubwww.manutd.com

For more information visit ...

55

World

New

s in B

rie

fW

orld

NNew

s iin

BBrie

f

Smart Card News � October 2004

Payment microprocessor cards deliveries have reachedthe level expected by the company. Sales as of theend of June 2004 have reached 210.8 million euros,a 7.3% increase compared with the previous year.

Problems with Visa/Dankort Abroad

Payment Business Services (PBS) have received anumber of reports from cardholders who are expe-riencing problems paying for goods with the newVisa/Dankort Smart Card. So far the reports con-cern a few high street and airport shops in England,plus a number of websites. PBS have stated that thelong 'lifetime' of the new Visa/Dankort cards maybe the reason why people are experiencing difficul-ties in some high street shops (primarily in England)and certain Internet shops.

SBM Partner with Aconite

Saudi Business Machines (SBM), the General Mar-keting and Services Representative for IBM WorldTrade Corporation, has signed a strategic alliancewith international Smart Card solutions provider,Aconite, to drive the adoption of Smart Card tech-nology in Saudi Arabia. The agreement with the Jed-dah-based SBM will see Aconite's suite of productsbeing sold and supported throughout the Kingdom'sburgeoning Smart Card sector. The launch of SmartCards is expected in 2005, following EMV Saudi Ara-bia requirements issued by the Saudi Arabian Mon-etary Authority (SAMA) and the subsequent imple-mentation of the necessary infrastructure.

Axalto Combats Road Safety

Axalto has announced it has been selected by theDutch Ministry of Transport, Public Works andWater management, and Luxembourg Ministry ofTransport to integrate its Smart Card technology intodigital tachograph cards that will be available short-ly to road transport professionals. This highly securetechnological solution will not only combat roadsafety violations but also enable efficient fleet man-agement by European hauling companies.

RFID to Track Medical Waste

Medical waste is an increasing issue. The U.S. sendssome 2 million tons of medical waste to incinera-tors and landfills each year. And Japan's Environ-ment Ministry estimated last year that more than 11million cubic meters of industrial waste had been

illegally dumped around the country. Medical wasterepresents only a tiny fraction of that sum, but it isof particular concern because of potential healthproblems. To tackle this problem Kureha Environ-mental Engineering Co. Ltd., a waste managementcompany, and IBM have teamed up to track medicalwaste as it leaves hospitals. Testing will begin on radiofrequency identification (RFID) tags to ensure thatmedical waste reaches its proper disposal point. IBMJapan's RFID Solution Center in Yamato, Japan, willcollaborate in the test.

During the trials the cardboard or plastic containersthat hold the waste will be outfitted with RFID tags.Intensive testing at the Yamato facility will examinehow well these tags transmit information in a vari-ety of situations. After those trials are completed,testing will move on to Kureha Environmental Engi-neering's waste processing site. Once the effective-ness of RFID tagging is confirmed, the companyplans to equip Kureha General Hospital, in Fukushi-ma, Japan, with the RFID technology to track its dis-carded medical waste. This is the first study in AsiaPacific of tracking medical waste and represents anew application for RFID.

Memory Card goes Contactless

Matsushita Electric Industrial Co Ltd., best knownfor its Panasonic brand products, has developed theindustry's first SD Memory Card with contactlessSmart Card capabilities. Called smartSD Card, thenew SD Memory Card combines the convenienceof contactless data communication capabilities withlarge storage capacity and high security.

The company will position the smartSD Card as keyto realising the "ubiquitous network society" and willstrive to create new business opportunities not onlyin the device sector but also in the system and solu-tion service sectors.

Honeywell and LEGIC Team

LEGIC Identsystems Ltd has signed a global licens-ing agreement with Honeywell. The partnership willallow Honeywell Building Solutions to incorporateaccess control application solutions from LEGIC, asupplier of contactless Smart Card technology, intoits portfolio of Smart Cards and readers. This willgive Honeywell customers a broader range of solu-tions for their building security applications.

66

World

New

s in B

rie

fW

orld

NNew

s iin

BBrie

f

Smart Card News � October 2004

Plymouth Rolls out Smart Cards

Plymouth City Bus is going 'smart' - replacing theirexisting Wayfarer 3 system with the company's lat-est Smart-enabled TGX150 revenue collection tech-nology. Wayfarer is working with the operator on aninstallation programme involving the introductionof new ticketing technology as well as a Radio LANfacility. The result will be a system that will interfacewith both the existing back office and Plymouth CityCouncil's new ITSO Smart Card operation, so help-ing to facilitate the roll-out of the "PLYM" SmartCard across the city.

Biometric System for US DoD

Lockheed Martin has been awarded a five-year con-tract by the US Department of Defense to config-ure, build and maintain a new Automated BiometricIdentification System (ABIS) that will consolidate,store, and search fingerprint data collected world-wide by the department.

This new system will be patterned after the success-ful Integrated Automated Fingerprint IdentificationSystem (IAFIS), which Lockheed Martin developedand now maintains for the Federal Bureau of Inves-tigation at its Criminal Justice Information ServicesDivision in Clarksburg, W.Va.

Biometric Trials for PACOM

Space and Naval Warfare Systems Activity Pacifichas chosen Bioscrypt's V-Smart iClass biometricaccess control reader to augment physical access con-trol at Pacific Command Headquarters (PACOM),and to analyze the benefits of implementing biomet-ric contactless technologies for future generationsof the Common Access Card (CAC) at Navy RegionHawaii and other Naval installations throughout thePacific region.

Datastrip Selected Fujitsu

Datastrip Corporation has selected the FujitsuMBF200 single-touch fingerprint sensor for use inits portable biometric Smart Card reader, the DSVII-SC. The Datastrip DSVII-SC verifies identities byreading contact and contactless chips on ID cards,passports, driver's licenses and other personal docu-ments.

ThinkPad goes BiometricIBM has announced that their new ThinkPad note-book line will use biometrics to increase the securi-ty on their laptop range. The new ThinkPad will havean embedded fingerprint scanner, which will replacepasswords for user sign-on access to the laptop. TheThinkPad's new reader will be on a wrist rest belowthe arrow keys on select models of the T42. To logon to systems, software applications, databases orWeb sites, users must swipe a finger across a small,horizontally oriented sensor.

ACG Wins Public Tender ACG Identification GmbH has recently won a pub-lic tender from Bundesversicherungsanstalt fürAngestellte (BfA), Germany's national provider ofsocial security services. ACG will deliver 30,000OMNIKEY CardMan 3121 USB Smart Card read-ers to various BfA subsidiaries by the end of Octo-ber 2004. BfA will use the OMNIKEY CardMan3121 readers along with hybrid cards for PC accesscontrol and electronic signature applications.

Security without a Smart Card NDS has announced a secure content protectionsolution for two-way IP TV network operators. VGS,part of NDS's IP content security solution, Syna-media, is aimed at telecom and broadband operators.Built on NDS's hardware based conditional access,VideoGuard, VGS offers two-way connected net-works a secure solution for the delivery of videocontent without the need for a Smart Card. NDS hasworked closely with major chipset manufacturers todevelop secure processors that can communicatewith secure servers based at the network headendthat provide strong content protection.

" Matsushita Electric Industrial Co

www.panasonic.co.jp/maco/en/

LEGIC Identsystems Ltdwww.legic.com

Lockheed Martinwww.lockheedmartin.com

IBMwww.ibm.com

ACG Identification www.acg.de

For more information visit ...

77

Spotlig

ht

Spotlig

ht

Smart Cards News � October 2004

Treviso Launches Fares that go down as you Travel!

The fortified city, located 30 km north of Venice, is proud of its many attractions. Each time the Smart Cardis validated, the number of times it has been used since purchase is calculated. Beyond a certain level, thefare per bus-ride goes down. It may seem simple, but the system is as complex as it is innovative. And it'scomplex in several ways. To begin with, it took local councillors over a year to come up with their dream busticket. As well as a traditional magnetic system, with single tickets, season tickets and three fare zones, therewas a contactless ticketing system, providing a dual solution. The idea of a stored-value card came up at thelast moment, after months of new versions and lengthy discussions with the Ascom team. "Supporting ourclients from start to finish is all part of our job", says Eliane Dejoux, the Ascom project manager who ledthe project and who makes no secret of how pleased she is that it has come to fruition.

Each detail was studied and discussed, each detail carefully weighed and sometimes reversed. Local council-lors held long and intense meetings on every aspect of the card, including its design. Appearance is clearlyan important factor in Treviso. Launched in Autumn 2004, the Treviso experience will be closely watched bypublic transport professionals and, of course, the politicians faced with the need to reduce urban car trafficacross most of the world. But the importance of the Treviso experience is relative, as Elian Dejoux explains:"Treviso has only one urban transport operator. The project would have been totally different if we had hadto develop a fare-for-use system in a multi-operator environment!" Another ambitious city may well per-suade Ascom to take on that challenge somewhere else in the world. Or perhaps, somewhere else in Italy,where the company installed 85% of recent "dual" or contactless solutions.

In another announcement Ascom's Division of Transport Revenue reported they had won a major order inNorway from the Norwegian State Railway. The order is for a comprehensive, networked fare collection andaccess control system based on advanced electronic ticketing technologies. The project volume amounts toabout $16 million. Ascom saw off some established international competitors in its bid for this project. Thefare collection solution uses a contactless smart card for data storage and customers can plan and book theirjourney via the internet. The system includes 159 stations, where 162 automatic ticket machines have beeninstalled, 40 service terminals and 345 validators. Ascom have been involved in the Paris public transportsystem RATP, the French Railways SNCF, the Milan public transport system, the Swiss Federal Railways andthe Montreal Metropolitan area public transport authorities in Canada.

Treviso's new stored-value card is original - and may even be one of akind. It encourages use of public transport by offering fares which godown depending on how many times the card is validated, calculatedaccording to how often it is actually used over a given period. "Use pub-lic transport more often and pay less." That's the logic behind the stored-value card that will soon be in use on the 100 urban buses of Treviso.

The local government in Treviso wanted to give the project every chanceof success by keeping control of changes in the way the system func-tions, and deciding how to calculate the value of each card. Only full-scale experience will prove whether a fare system which encourages pas-sengers to use the service will actually be effective. Does it make moresense to count the number of journeys over a given period, or the totalamount of money deducted from the card? Should the system take accountof use of the card over consecutive days? And what are the right thresh-olds for each one of these different hypotheses?

88

Opin

ion

Opin

ion

Smart Card News � October 2004

Using Contactless Technology in Secure Identification SystemsBy Randy Vanderhoof, Executive Director, Smart Card Alliance

Smart Card technology is increasingly accepted as the ideal platform for secure ID systems, not only becauseof the increased security it provides, but also because of the advantages it delivers for ease of use and multi-purpose functionality. The maturing of contactless Smart Card technology has also driven its use in a widevariety of applications requiring fast, secure access - from payment to building access to passports.This arti-cle will first look at the requirements for establishing a secure identification system and then review the trendto use contactless Smart Card technology in secure ID systems.

Secure ID System Requirements: A secure ID system is designed to address one primary requirement:verify that an individual is who the individual claims to be. When properly designed, secure ID systems imple-ment a chain of trust, assuring everyone involved that the individual presenting an ID card or token is theperson who owns the credentials on the ID and that the credentials are valid. A secure ID system can pro-vide individuals with trusted credentials that are used for a wide range of applications, from enabling accessto facilities or networks to proving entitlement for services to conducting online transactions. Critical to anysecure ID system is the physical ID device. This device can take many form factors, including a plastic card,Universal Serial Bus device, or a chip-based passport. The ID device is used as a portable, trusted and verifi-able representation of an individual's identity and rights and privileges within the ID system. For an ID tomeet these requirements, the ID system must assure that a legitimate authority issued the ID, that the IDand the credential it carries are not counterfeit or altered, and that the person carrying the ID matches theindividual who enrolled in the ID system. The figure to the right summarizes the key links in a secure IDsystem chain of trust during the identity authentication process when the ID is used.

Smart Card Technology and Secure ID Systems: Smart Card technology significantly strengthens securi-ty in a secure ID system, protecting both the electronic credential used to authenticate an individual and thephysical device. Since the credential is permanently stored on the card, it is never available for an unautho-rized user to steal. Smart Cards build protection into the physical device by supporting tamper-resistant fea-tures and active security techniques for encrypting communications and supporting mutual authenticationbetween the card and reader. With the ability to store, protect and modify information written to the on-card electronic device (i.e., chip), Smart Cards offer unmatched flexibility and options for information shar-ing and transfer, while providing the unique ability to incorporate privacy-sensitive features.

Contactless Smart Card technologies offer security professionals features that can enhance systems designedto control physical or logical access. Contactless cards differ from traditional contact Smart Cards by notrequiring physical connectivity to the reader. The card is simply presented in close enough proximity to thereader and uses radio frequencies (RF) to exchange information. The use of contactless Smart Card technol-ogy is particularly attractive for secure physical access, where the ID credential and reader must work in harshoperating conditions, with a high volume of use or with a high degree of user convenience.

Organisations are increasingly concerned with the problem of how to verify a person'sidentity and privileges before granting that person physical access to a building or placeor logical access to information or other online resources. Solving this problem is driv-ing both businesses and governments to implement new secure identification systemsthat provide increased access control security. These new systems are making funda-mental changes in access control policies, processes and technologies -- within an organ-ization, among organisations that collaborate as partners, between customers and busi-nesses, and between citizens and governments.Randy Vanderhoof

99

Opin

ion

Opin

ion

Smart Card News � October 2004

While there are several international standards for contactless Smart Cards, ISO/IEC 14443 is the mostwidely used and is the contactless standard included in the United States government's Government SmartCard Interoperability Specification (GSC-IS) and in the International Civil Aviation Organization (ICAO)specification for Machine Readable Travel Documents (MRTD).

Smart cCards supporting both contact and contactless identification (e.g., for logical and physical access) areoften described as either hybrid or dual-interface chip Smart Cards. A hybrid card contains two chips, onesupporting a contact interface and one supporting a contactless interface. The chips are generally not con-nected. A dual-interface chip card contains a single chip that supports both contact and contactless inter-faces. Dual-interface cards provide both contact and contactless functionality with a single chip in a singlecard, with current designs allowing the same information to be accessed using either contact or contactlessreaders. Today, smart chip manufacturers are beginning to deliver dual-interface chips with the performanceand processing capabilities required to support sophisticated logical access applications. Dual-interface cardsare now available that have achieved FIPS140-2 , Level 3 certification (as a finished card) or Common Crite-ria EAL 5+ (as an integrated circuit). These security levels are as high as are available from contact-onlysmart cards.

Smart Cards also provide an excellent solution for secure ID systems that are using biometrics as a factorfor authenticating individuals. The Smart Card can securely store the cardholder's biometric data. When thecard is presented to a biometric reader, the biometric information is retrieved from the card and comparedto the actual cardholder biometric captured at the access point to validate the cardholder's identity. If theapplication uses one of the more powerful Smart Cards with an embedded microcontroller, the biometricdata can be compared and matched on the card. A "match on card" assures the greatest degree of privacy.The biometric data never leaves the card, and the card can be destroyed when the cardholder no longer needsthe identity credential.

Conclusion: Governments and businesses around the world are tackling the problem of securely provingthe identity of individuals attempting to gain access to physical facilities or logical resources. Smart Cardtechnology - both contact and contactless and in a variety of form factors - is a vital link in the chain of trustfor a secure ID system. It is providing the foundation for implementations of new secure access control sys-tems worldwide.

Making Life DifficultBy The Whistleblower

A spokesman for the 'National Program for IT' (NPfIT) told 'Computer Weekly' that it is generally acceptedin the IT industry that implementation costs are some three to five times the cost of procurement currentlystanding at £6.2bn. On a quick calculation and assuming 1 million staff, that works out at £18,600 per per-son, is it just me or isn't that excessive? The basis of this procurement is the award to a number of largecompanies to develop a particular part of the project, in effect each with their own proprietary modules.Industry has long since learned that the proprietary solution to a problem not only costs more but oftennever appears.

The news this month in the UK has been full of the IT modernization costs for theNational Health Service (NHS). The program includes a patient care record scheme, ahospital booking scheme with patient choice, and new local IT infrastructures. Initiallybudgeted at £2.3bn in 2002 over three years the figures rose to £6.2bn over 10 years.Now we are told it could cost a minimum of £18.6bn and that officials at the Depart-ment of Health think it could even be as high as £31bn.

1100

Opin

ion

Opin

ion

Smart Card News � October 2004

Suppliers rise and fall as the development progresses. EDS earlier this year lost their contract for the secureemail and directory service for the NHS to Cable and Wireless worth £164 million over 10 years. It wasequally unfortunate to lose out to BT Group last year on the award of the NHS patient record system. Thelist is endless but the point at issue is about the best way to handle large projects funded by government.Take just the secure email, why can't the NHS use off the shelf components as would any commercial organ-ization? Apparently they have been using 7000 different email services, but isn't the solution just a matter ofspecifying standards? Does anyone seriously suggest that there aren't adequate products in the market placeto choose from?

So how does the Smart Card industry compare? In the mobile telecommunications industry we can see a bigsuccess story with the GSM SIM card which really launched the future of microprocessor smart cards fromthe early 90s. ETSI at the time specified the standards for the GSM service (using existing standards whererelevant and appropriate) which were duly published and open to all vendors. Each of the Network Opera-tors is free to choose its products from any vendors who can meet the specifications. Market forces prevail!The EMV (Eurocard, Mastercard, and Visa) Smart Card to replace the existing magnetic stripe is looking tobe an equally successful project. Again the specifications have been openly published and banks and retailersalike are free to choose the supplier of their components subject to them meeting the specifications. Thisleads to competitive pricing for cards and terminals and although margins may be reduced at least it's opento any that are competent to play both small and large.

What about other Smart Card projects? Well in the US the DoD is well ahead in its published specificationsfor the Conditional Access Card (CAC), The International Civil Aviation Organisation (ICAO) is also plow-ing ahead with its specifications for ePassports, and while we might argue the approach which leads to largeE2 memory chips at least the industry is able to respond in a competitive manner. ICAO is not paying forthe development of 64 kbyte Contactless memory chips.

In the UK we have seen the National Smart Card Project (NSCP) looking for interoperability at the LocalGovernment area and ITSO working on the interoperable transport scheme. The NSCP has not yet pub-lished its specifications but ITSO produced the latest version 2.1 in March 2004. ITSO used to stand for theIntegrated Transport Standards Organisation but now has lost the meaning and retained the letters to allowit to move further a field than just transport. The Department for Transport (DfT) has actively promotedthe scheme with financial incentives and there can be no doubt that the project is well known. ITSOs Gen-eral Manager of 4 months, Paul Newman has just suddenly left, apparently to take up other consulting con-tracts, this must be a new way of describing 'pursuing other interests'

However well known this project is not being supported with the same enthusiasm by either service providersor major vendors - why? In the first instance the largest single Smart Card transport scheme, TfL (Transportfor London) already has its own proprietary 'Oyster' scheme issued to more than 2 million customers (as atJune 2004). The developers of the ITSO specifications had a problem, do you start with a green field or doyou incorporate existing products? They chose the later, the Oyster and Calypso Contactless cards for exam-ple are included in the ITSO specifications. Whilst a pragmatic choice perhaps, you are faced with two prob-lems (at least).

The overall architecture particularly the security management becomes overly complex to handle all theoptions and in addition the solution is not attractive to the existing players. If you are a regulator you canuse a stick otherwise it has to be a juicy carrot and who will pay for this inducement? If the DfT feels unableto continue its sponsorship it might just all fizzle out because nobody else can apply the necessary influence.Simplification might be another way to solve the problem!

Off with the Old, on with the NewBy Peter Tomlinson, Independent Consultant, Iosis Associates

So here we are, with eGU rather than Gnu, run by the new man Ian Watmore. What a lot we expect of him(perhaps). Does another couplet from Flanders and Swan apply to him?

A year ago last Thursday I was strolling in the zoo when I met a man who thought he knew the lot.

And it goes on:So I asked him: 'What's that creature there?'

He answered: 'Oh, H'it's a H'elk' I might of gone on thinking that was true,

If the animal in question hadn't put that chap to shame And remarked: 'I h'aint a H'elk. I'm a Gnu!'

So what is eGU? Does it have a character of its own? eGU must be here to implement government policy inInformation and Communications Technologies, which is to bring into the public sector best practice fromall quarters, and to promulgate information assurance. Its all there in Cabinet Office papers on their websites - the policy, but not the method. eGU needs the funding to bring in the best practice and promulgate itthroughout the public sector, bringing relief to those stalwarts in public bodies who have boldly gone aheadalone; the industry must match that commitment with its best troops.

Flanders and Swan carried on to recall another encounter:

Among the hunting trophies on the wall above my bed Stuffed and mounted, was a face I thought I knew;

A Bison? No, it's not a Bison. An Okapi? Unlikely, Really. A Hartebeest? When I thought I heard a voice: 'I'm a Gnu!'

The opportunity for industry partners to participate in eGU deliberations is at the regular meetings of theirSmart Card Working Group. That group currently considers function only. There are those of us from theindustry who have consistently said that, in the use of secure tokens (often implemented as Smart Cards),security methods must from the beginning be considered together with functional methods. They are notseparate animals - they are both parts of the same concept. Yet the previous Cabinet Office model of sepa-rate treatment of the two parts (in OeE and CSIA) continued unchanged at the summer meeting.

Oh, g-no, g-no, g-no, G-no g-no g-no I'm a Gnu G-no g-no g-no I'm a Gnu

It's very G-nice of you (to be here, I presume F&S meant).

1111

Opin

ion

Opin

ion

Smart Card News � October 2004

The Office of the e-Envoy has become the e-Government Unit of the Cabinet Office -eGU. I couldn't help bringing to mind the Flanders and Swan song:

I'm a Gnu, I'm a Gnu The g-nicest work of g-nature in the zoo I'm a Gnu, How do you do You really ought to k-now w-ho's w-ho's I'm a Gnu, Spelt G-N-U I'm g-not a Camel or a Kangaroo So let me introduce, I'm g-neither man nor moose Oh g-no g-no g-no I'm a Gnu'

Peter Thomlinson

1122

Opin

ion

Opin

ion

Smart Card News � October 2004

When It Comes To Targeting Customers &Keeping Them Loyal, It's All About RelevanceBy Malcolm Fowler, Vice President & General Manager, Ernex

The type of card consumers carry in their wallet will not help an organization's loyalty program succeed -the reward relevance and the program delivery method will. Smart Card adoption has been high in Europeand Asia, driven by challenging credit card verification capabilities in a telecom infrastructure that is not asrobust as that of North America. The Smart Card, which stores data directly on the card, has helped toreduce fraud at considerable cost savings for card issuers. In North America, the robust telecom infrastruc-ture allows real-time verification of magnetic stripe cards for banking and loyalty reward programs withoutthe need for additional infrastructure. Loyalty programs based on Smart Card technology attempt to offsethigher card costs with reduced telecommunication costs by storing loyalty data on the card and enabling pro-gram rules at the point-of-sale (rather than at a centralized host). These speed and efficiency gains are offsetby two factors: (a) the desire of many loyalty operators to analyze data in a central location, necessitating itsperiodic collection; and (b) the challenges in updating program rules at each point-of-sale when changes arerequired.

Most retailers in North America currently have the magnetic stripe technology and telecom infrastructure inplace to cost-effectively enable host-based, real-time loyalty programs. This structure allows businesses toupdate program rules once, in a central location, without the extra effort of "touching" all their individualpoints-of-sale. Since more information can be stored in these types of real-time databases, organizationshave the ability to take advantage of the added depth and richness of customer information. The popularityof customer loyalty programs is at an all-time high. According to an analyst report by industry research firmGartner Inc., more than 60 million Americans belong to at least one of more than 200 U.S. based loyaltyprograms , making these programs so widespread that customers have increasingly come to expect them.

For organizations that are looking to loyalty programs as a way to recognise and retain their best customers,the benefits of real-time are clear. By pushing the rewards redemption processes to the front line in real-time, an organization can reduce or eliminate resources spent on call centers and fulfillment warehouses,while customers can avoid the long delivery times often associated with reward fulfillment. Real-time loyaltymakes sense, especially since instant gratification strikes at the core of making a program relevant to a con-sumer, not to mention successful to the bottom-line.

But the benefits don't stop there. It is widely accepted that 20% of customers produce 80% of profits, andsome industry analysts will even claim that more than 100% of profits are driven by the top customer seg-ments. Think this isn't important to your business? Think again, as the bottom segments of a business' cus-tomers can actually contribute negatively to profits. Real-time loyalty programs can help an organizationidentify its best customers, reward them for their patronage, and weed out the rest. While many industrypundits closely followed the progress of retail giant Target and its foray into the Smart Card loyalty market,most failed to realize that it was not the Smart Card technology itself that failed. With a reported investmentof $50 million in infrastructure, Target was able to attract a purported 9 million customers to its loyalty-enabled card, proving that the interest and opportunity in loyalty benefits existed.

Much analysis has gone into the debate about which type of loyalty instrument is mosteffective in helping businesses dynamically interact with customers in order to build andmaintain more profitable relationships. The debate, focused on Smart Cards versus mag-netic stripe cards, is irrelevant.

Malcolm Fowler

1133

On th

e M

ove

On tth

e MM

ove

Smart Card News � October 2004

The problem was that consumers ignored the high-tech Smart Card loyalty features because the perks andbenefits were not delivered in a relevant manner. Target's program required consumers to go to a specialkiosk in order to access the loyalty coupons for redemption at the point-of-sale. In the end, the debate thatfocuses on Smart Cards versus magnetic stripe cards is irrelevant. Magnetic stripe cards, Smart Cards, fingerprint devices or retinal scans are simply the identifier for a host-based loyalty solution. There is good reasonto believe that Smart Card technology may yet emerge as the technology of choice to reduce credit cardfraud in North America.

However, an effective customer loyalty program is not about the type of customer interface, but rather thebenefits associated with it. Businesses wanting to adopt their own rewards program should consider a solu-tion that is real-time in nature, which allows customers to be rewarded and/or recognised right at the point-of-sale. Most importantly, businesses should specifically focus on the relevance of their rewards. Ultimately,acknowledging consumer preferences and delivering rewards in real-time for their patronage is what willmake your loyalty program successful - not to mention smart.

Paul Newman Resigns from ITSO

Paul Newman has asked to leave ITSO to take up aconsultancy opportunity and that ITSO, with someregret as to timescales since this has arisen at shortnotice, has agreed to release Paul with immediateeffect. Paul will be handing over to Mike Eastham,as Interim General Manager, with immediate effect.

Change at the Head of G&D

Chairman of the Board and CEO of Giesecke &Devrient, Willi Berchtold has left the compnay in aharmonious mutual agreement. Until Mr. Berchtold'ssuccessor has been appointed, board members Dr.Walter Schlebusch and Dr. Peter Zattler will managethe company on an acting basis.

Cubic Announces New CEO

Cubic Transportation Systems has named DaveLapczynski as the new Chief Operating Officer, over-seeing all program management, engineering, andmanufacturing functions for the Company.

New Head of Unit for LEGIC

LEGIC Identsystems Ltd has appointed Robert MFee as the new General Manager of its North Amer-ican Business Unit. The continued growth of inter-est in the use of the LEGIC 13.56 MHz contactlessSmart Card technology in North America has led tothe decision to establish a dedicated new businessunit to continue growing the brand in the US, with

a main office headquarted in Miami Lakes, Floridaand a field sales office located in Napeville, Illinois,USA.

New President for Gemplus

Gemplus International S.A has appointment ofMichel Canitrot as President of Gemplus, LatinAmerica, reporting to Philippe Vallée, ExecutiveVice President. This appointment is part of Gem-plus' strategy to maximize the geographical oppor-tunities for Smart Card development and enhanceits regional presence. Michel, 58, brings many yearsof experience in Sales and Marketing management.

New Director of Quality at VCT

Versatile Card Technology Inc. (VCT) has promot-ed Joseph Cruz to Corporate Director of Quality& Statistics. Cruz, who has been with the compa-ny since 1999, has held several positions in the com-pany and will now serve as a Corporate Directormanaging the VCT Qualteq Division in South Plain-field, New Jersay, USA.

STS Appoint Jon Cairns

Smart Technology Solutions (STS) have appointedJon Cairns as business development director. Withextensive experience in the software and electron-ic payments sector, Jon Cairns will be a key con-tributor to STS' continued development at a keyphase in the company's growth.

On the MoOn the Movvee

1144

Round T

able

Specia

lR

ound TT

able

SSpecia

l

Smart Cards News � October 2004

The End of Cash as We Know it?By Patsy Everett, Managing Director, Smart Card News Ltd

Susie Lonie, senior product manager at Vodafone agreed and used the analogy of purchasing shoes on a Sat-urday in the high street. The consumer is not interested in the payment mechanism the retailer is going touse, just the shoes. Consumers do not want an interesting experience with an interactive payment product,they want it to be quick, easy and secure. Mike Short VP at O2 said that their evidence showed that someconsumers would prefer anonymity for certain types of content and that some devices presented barriersand this was an issue for handset manufacturers as well as carriers.

"There is an intangible fun factor in SMS and you see people texting for no good reason other than it is afun thing to do. That�s why, I think, the use of SMS as a paying mechanism took everyone by surprise, abilling mechanism based on SMS which, in the UK was invented by Vodafone by accident, has turned into apaying mechanism which has completely disrupted the entire content value chain because it is fun, easy, ubiq-uitous, simple and familiar, it was physiologically appealing. That is a much stronger argument than any tech-nological virtue."Bud said.

David Birch of Hyperion made the point that we would all love to pay for our parking ticket, for example,with our mobile phone but if you have to go to a website, login, punch in your password then send yourmessage and then the phone rings you back with your PIN, its just to complicated. He then went on to pointout that Mondex offered a good secure anonymous payment system and that if operators had put that inthe system in the first place then the current discussion would not be taking place.

It is now 7 years since the first ring-tone was launched and Musiwave are seeing a 15% growth month onmonth in music and video downloads. Gilles Babinet of Musiwave thinks one of the key reasons why mobileis so successful for voice is because it�s easy not because it is technically viable. Oliver Steely of MasterCardpointed out that there is one main question asked by retailers and that is how many people can pay with thistechnology and the customer wants to know where they can spend using the technology.

At a recent mobile industry round table hosted by the CEO of Valista Raomal Perera,leading lights in the industry discussed their thoughts on where they think the industryand the technology is going and whether this is what the consumer wants, particularlythe youth market.

Patsy Everett

Jean Benoit van Bunnen of the Orange group thought that simplicity ofuse was the main requirement, and the service being offered should beperceived as a trusted brand with no complex registration processes, anda fully integrated payment system.

Andrew Bud of mBLOX made the very interesting observation that SMS wasan old technology initially developed for service engineers and mobile per-sonnel as a replacement for paging, and said "Consumers have picked up thistechnology, quite without permission because it was very cheap, absolutelyubiquitous and simple to use. Based on these rather unscientific, un-technicaljustifications they turned this into the biggest media channel that has everexisted".

1155

Events D

iary

Events

DDia

ry

Smart Card News � October 2004

Banks do not want to process the small payments but are keen to process the larger amounts such as thoseused to top-up a pre-pay phone card, so there is no competition between the banks and mobile industrywhen it comes to micro-payments.

Oliver Steely agreed "I think Tim�s point about turning phones into the mini PC is absolutely crucial. Andthe reason I say that, from our perspective, it is more about the browsing and the Internet experience thanabout file formats and proprietary technology. In the card industry, we have a solution for securing remotecredit card payments. It is an agreement that we came to between ourselves and VISA and American Express,and our UK banks are deploying it right now." he said

It works on the remote channel and I�m probably in the wrong room to say this guys but you know mobileis just one of five or six different remote channels that our bank customers are going to use, so let�s buildsomething that allows payments to happen across all of those remote channels simultaneously. Let�s not tryand build something that only works in one sub-setting because the losers will be the consumers and themerchants." mr Steely said.

At the end of the day consumers are happy with their credit cards, they have been around for 30 years ormore and are part of a $4trillion global industry, they may even one day be found in the mobile phone butnot for micro-payments, the overheads are to high. As Susie Lonie pointed out if you lose your credit card ittakes about 80 hours before you realise it, if you lose your phone it�s about 8 minutes. There is obviously aplace for both technologies and perhaps the mobile phone will see the end of cash as we know it.

November 2004

2 - 4 Cartes 2004 & IT Security 2004 - Paris, France - www.cartes.com - www.itsecurityexpo.com15 - 17 Inside ID Conference & Expo 2004 - Washington DC, USA - www.jupiterevents.com16 Smart Card Club - London, UK - www.smartex.com17 Infosecurity Manchester - Manchester, UK - www.infosecroadshow.co.uk17 - 19 ID World International Congress 2004 - Barcelona,Spain - www.idworldonline.com18 - 19 EFMA Loyalty Conference Programme - Prague - www.efma.com/loyalty 22 - 24 Middle East Financial Technology Exhibition & Conference - Bahrain - www.meftec.com

December 2004

7 - 8 RFID for Contactless Payment Systems - Atlanta, Georgia, USA - www.iqpc.com/technologyiq 14 Smart Card Club - London, UK - www.smartex.com9-10 The 9th eESC Open Conference - Prague

January 2005

26 - 27 Security Printing & Alternative Solutions in Russia - Moscow, Russia

February 2005

14 - 16 GSM World Congress - Cannes, France - http://www.3gsmworldcongress.com

Tim Jones, CEO at Simpay made the point that the mobile industry is notcompeting with credit cards but enabling, that there is a role for a paymentscheme structured to support low value payments. Tim also can�t wait forthe mobile phone to look like a miniature PC as the PC industry has a goodfile format for music, still images and video.

EvEvents Diarents Diar yy

1166

Market in

Fig

ures

Market iin

FFig

ures

Smart Card News � October 2004

Continued US Investment In Smart CardsBy Jason Smith, Production Editor, Smart Card News Ltd

Since the 1990s, the federal government has considered the use of Smart Card technology and in 1996, theGeneral Services Administration (GSA) was tasked with taking the lead in facilitating a coordinated intergency management approach for the adoption of multi-application Smart Cards across government. To makeit easier for federal agencies to acquire commercial Smart Card products, the GSA developed the govern-ment wide Smart Card Access Common ID contract, which allows federal agencies, those covered by theChief Financial Officers Act as well as the Department of Homeland Security (DHS), to procure SmartCard products and services. By using this contract, federal agencies can help reduce the cost of Smart Cardsand ensure that vendors incorporate interoperability specifications, according to the director of GSA's Cen-ter for Smart Card Solutions.

In a report by the US Government Accountability Office (GAO) entitled "Federal Agencies Continue toInvest in Smart Card Technology" they documented the progress made by the federal government in promoting Smart Card technology. The survey involved 24 major federal agencies regarding the status of theirSmart Card projects. The report was originally carried out in January 2003, and since that time 28 out of the52 Smart Card projects that were reported as ongoing have since discontinued, as of June 2004, because theywere absorbed into other Smart Card projects or were deemed no longer feasible. Of the remaining 24 proj-ects, 16 are in planning, pilot, or operational phases and are intended to support a variety of uses (the agen-cies did not provide current information on the remaining 8).

Twelve of the 16 projects are large-scale projects intended to provide identity credentials to an entire agency'semployees or other large groups of individuals. Examples include the Department of Defense's (DOD)Common Access Card (CAC), which is to be issued to an estimated 3.5 million DOD-related personnel, andthe Transportation Security Administration's Transportation Worker Identification Credential, which is to beused by an estimated 6 million transportation industry workers. Based on this survey of federal agencies, 10additional Smart Card projects have been initiated since their last review was completed.

Smart Card Technology is becoming a key factor in helping the federal government pro-vide security for its many physical and information assets. Smart Cards offer the federalgovernment a secure verification process for identifying employees and other personnelwho need access to buildings and logical access to computer systems. They also offerto support other business-related functions in areas such as tracking immunisationrecords or storing cash value for electronic purchases.

Jason Smith

Source: GAO

1177

Market in

Fig

ures

Market iin

FFig

ures

Smart Card News � October 2004

Included are small-scale projects, involving cards issued to as few as 126 cardholders (such as a project inthe Department of Labour's Employment and Training Administration), and large-scale agency wide initia-tives, such as, the Department of Veterans Affairs (VA) Authentication and Authorization Infrastructurecard, which is to be issued to an estimated 500,000 employees and contractors.

Four of these agencies reported purchases under the GSA's Smart Card Access Common ID contractingvehicle, and others likewise have plans to use this contract. Between December 2004 and December 2008,five agencies including NASA and the Departments of Defense, Homeland Security, the Interior, and Veter-ans Affairs-are planning to make an aggregated purchase of up to 40 million cards through the GSA con-tract. As part of this purchase, these agencies are scheduled to begin making quarterly procurements begin-ning in December 2004 of approximately 1.2 million cards. In response to the survey, the majority of theagencies (4 out of 7) that reported new initiatives said that they purchased Smart Cards under the GSA con-tract. The remaining agencies cited reasons for not acquiring Smart Cards under the GSA contract, such aspurchase arrangements with another agency or purchases under other types of contracts.

In 2003, the Office of Management and Budget (OMB), in accordance with the President's vision of creat-ing a more responsive and cost-effective government, issued a memorandum to federal chief informationofficers outlining details of the E-Authentication E-Government initiative on authentication and identitymanagement. OMB also created the Federal Identity Credentialing Committee (FICC) to make policy rec-ommendations and develop the Federal Identity Credentialing component of the Federal Enterprise Archi-tecture, to include services such as identity proofing and credential management for the federal government.In February 2004, FICC issued policy guidance on the use of Smart Card-based systems in badge, identifica-tion, and credentialing systems with the objective of helping agencies plan, budget, establish, and implementcredential and identification systems for government employees and their agents.

For example, the Washington Metropolitan Area Transit Authority has deployed an automated fare collec-tion system using contactless Smart Cards as a way of speeding patrons access to the Washington D.C., sub-way system. Smart Cards can be configured to include both contact and contactless capabilities, but two sep-arate interfaces are needed because standards for the technologies are very different.

From this we can see that agencies across the US Government continue to actively invest in Smart Card Pro-jects with plans to issue millions of new cards for both physical and logical access for employees and otherpersonnel in the near future and the investment will grow. We can also establish that US agencies are alsomoving towards integrated agencywide credential projects, with several agencies planning to consolidate theirSmart Card purchases through GSA's Smart Card Access Common ID contract

Source: GAO analysis of data reported by Federal Agencies

1188

opin

ion

Opin

ion

Smart Card News � October 2004

For High Security: Contactless Smart Cardsare the AnswerBy Stephen Neff, Vice President Sales and Marketing, LEGIC Identsystems Ltd

Photo ID cards provide for ease of identification and increased security levels. However, they provide noreliable vehicle for identity verification. Forgers can recreate ID photos easily using digital cameras and highspeed printing facilities. While safeguards against forgery are available and are applied in, for instance, gov-ernment ID cards, these safeguards tend not to be applied in less sensitive environments in which a quickmanual inspection of the photo ID card is the most convenient method of verification.

First-generation technologies provide a higher level of security than photo-only IDs. Swipe cards, for exam-ple, contain ID data, usually stored in the form of a magnetic stripe, which is presented to the reader at theprotected door. These cards take little time to use. Each card can be individually programmed to permitaccess to only those areas a holder is authorised to enter. Other criteria such as time and date controls canalso be easily introduced, meaning those who are authorised to enter particular areas will be able to do soduring work hours, but can be prevented from entering at other times. If a card is lost or stolen, or if a mem-ber of staff to whom it was issued leaves without returning it, security personnel can delete that card fromthe reader's database or from the central computer.

The main drawback associated with first-generation systems is that the readers are prone to wear, and thecard data can be copied or altered. In addition, if no second level of verification takes place such as the useof a PIN - intruders can gain access by using lost or stolen cards without anyone noticing.

Technology has again moved on, and a new third generation of Smart Cards is looking to supersede theseolder technologies. Since the introduction of 13.56 MHz contactless Smart Card technology systems, accesscontrol systems have now merged into highly practical multifunctional systems that can be centrally and effi-ciently managed.

Photo IDs, first generation technology swipe cards and second generation low fre-quency proximity cards have long been around in the corporate security environmentfor the purposes of identification and access control. But while such systems haveproven reliable and effective for many years, they no longer meet today's requirementsin terms of security and the demand for tamperproof systems. Third generation 13.56MHz contactless Smart Card technology provides a comprehensive solution for highsecurity single and multi applications.

Stephen Neff

Second-generation technology cards, exemplified by low-frequency (125/134kHz) proximity systems, have over the years established themselves as a higher-security alternative to first generation technologies. They allow the convenienceof contactless operation, and they also offer the option of incorporating a PINfor verification. Proximity systems are not prone to wear and have a unique ID(UID) number that can be allocated to an employee and a site, which theoreti-cally cannot be copied. These systems as a rule have only a very small read onlymemory. Hence they offer no possibility to write information back to the cardand are unsuitable for use with 'Template-on-Card' biometrics systems and 'Net-work-on-card' applications. More critical, especially for high security applica-tions, is the fact that the UID number is not encrypted. This has now become,among experts, the biggest drawback where tamperproof requirements andhigh security is an issue.

1199

Opin

ion

Opin

ion

Smart Card News � October 2004

The Link to Biometrics: Like their predecessors, contactless Smart Cards can be exploited by unautho-rised users if safeguards are not in place, that is if a card is lost or stolen. However, loading biometrics infor-mation onto the memory of a contactless Smart Card (template on card) can solve this problem. This ensuresthat no one but the rightful owner can use the card. It also addresses privacy issues, since the biometric infor-mation is stored on the card and not in the biometric reader system.

There is a wide variety of biometric systems available that are suited to commercial use. It is possible toincorporate the use of retina, iris, hand, palm, fingerprint, vein, face or voice recognition data, or a combina-tion of any of these, onto a single card. Each facility's unique security needs should determine the right typeof reader for that facility. In choosing a biometric method, users may consider the needed level of conven-ience, speed and ease of use, level of security, cost, scalability, size and portability.

The enrolment process is usually done under the supervision of a site security officer to ensure that the card-holder being enrolled is indeed certified as the correct person.When a cardholder then attempts to enter asite, he or she presents the card to a biometric reader and subsequently presents his or her live biometric-fin-ger, hand, voice or eye, for instance. The reader will evaluate the live biometric and translate it into a num-ber, which it compares with the template stored on the card. If the two match, access is granted.

A whole host of other applications can be added to contactless Smart Cards initially or at a later date. Theseinclude cashless payment for vending and employee restaurant use, time and attendance, IT-Access, and park-ing lot access.

Contactless Smart Card systems, with their benefits for operators and cardholders, are not a thing of thefuture. They are already in use extensively. And in today's world, with its need for ever more vigilant security,the benefits of such technology cannot be ignored.

Up to 127 independent applications (for example, cashless payments, access,time & attendance, etc.) can be implemented on a single transponder.Dynamic multi-application management accommodates applications ofvarying memory size and in any sequence. This is particularly beneficial ifadditional applications have to be added to a transponder that is already inuse.

These read/write-capable systems can store significant personal data as well asaccess control information. Their larger memory allows them to offer more high-security features than less advanced cards making them best suited for many ofthe security applications that have recently opened up. Third generation 13.56MHz contactless Smart Card technology offers optimal security for data and appli-cations, from host communication to data memory on the transponder. The high-security encryption level (based on the industrial standard algorithm DES/3DES)can be individually configured for any application and any data path section.

To implement a contactless Smart Card/biometric system, the securitydepartment uses a biometric reader in a special mode to scan or enrol! thebiometric of each person authorised to be on the site. This data is thentranslated into a template using a special algorithm within the reader. Thetemplate is encrypted and written onto the Smart Card that is held up tothe biometric reader being used for enrolment.